<html>


<meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
<head>

<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
<link href="Update%20Sequence_files/topic000.css" rel="stylesheet" type="text/css">
<title>Update Sequence</title>
</head>

<body>

<h1>Update Sequence</h1>

<p>File records need a mechanism for integrity control of their contents. In NTFS update sequence is employed for that purpose.</p>

<p>16-bit update sequence number is recorded to the end of each sector forming a file record; these sectors are duplicated in the file record header. During each reading operation the last two bytes in a sector are compared with the corresponding header field and if NTFS driver finds a discrepancy then such file record is considered invalid.</p>

<p>The main purpose of the update sequence is protection against "recording breaks". If the power supply disappears during the process of sector recording to disk, it may happen that a half of a file record will be recorded successfully and the other half will retain its old contents (a file record usually consists of two sectors). During each sector rewriting, the sequence number grows by 1, so if a break in recording occurs, the value of the sequence number in the file record header will not match the number in the sector end.</p>

<p>Data replaced by the update sequence numbers are stored in a special update sequence array located in file record header right after the update sequence number. </p>

<p>To validate the integrity of a file record, it is necessary to read from the header the pointer to a sequence number (it is stored at offset 04h bytes from the header beginning) and compare the 16-bit value at that address with the last word of each of the sectors forming the file record. Their mismatch means that the corresponding data structure is damaged and it should be used very carefully.</p>

<h6><img src="Update%20Sequence_files/update_s.gif"></h6>

<h6>Verification of file record integrity</h6>

<p>After successful integrity check of a file record, it is necessary to restore its original form (assuming modification of a sector copy in memory). For that purpose there is a 16-bit field at offset 06h from the sector beginning. It contains the total size of the update sequence number together with the update sequence array (SizeOf(update sequence number)&nbsp;+&nbsp;SizeOf(update sequence array)), expressed in words (two bytes). The size of an update sequence number is always equal to one word; therefore, the value of the 16-bit field at offset 06h minus one defines the number of sectors in a file record. The first word in an update array corresponds to the last word in the first sector of a file record. The second one corresponds to the last word in the second sector, etc. </p>

<h6><img src="Update%20Sequence_files/update_t.gif"></h6>

<h6>Restoration of a file record copy in memory </h6>

<p><br> <br>
</p>
</body>
</html>

<!-- This document saved from http://www.pc-3000flash.com/eng/help/help_information/ntfs/update_sequence.htm -->
